Commentary
Content posted in February 2012
It's True: Compliance Can Be Good For Your Business
Commentary  |  2/29/2012  | 
The best insurance for your organization is often the processes required for compliance
Why BYOD Doesn't Always Work In Healthcare
Commentary  |  2/28/2012  | 
Security and screen layout problems make it difficult to let clinicians bring their own tablets and smartphones to work.
RSA Conference, One Year Later
Commentary  |  2/27/2012  | 
How I hope history has reshaped this year's RSA Conference one year after one of the most significant breaches in the past decade
Can You Train A Great Penetration Tester?
Commentary  |  2/27/2012  | 
The hacker mindset can't be taught -- it must be developed and refined over time
Bots: Stand Up And Be Counted
Commentary  |  2/24/2012  | 
A new FCC-backed initiative will gather real ISP data on infected bot machines, but will it make a dent on the botnet scourge?
Don't Be Fooled By Buzzwords, Flash, And Empty Promises
Commentary  |  2/24/2012  | 
Heading to San Francisco for RSA, BSides and AGC? Make sure you know how to navigate the vendor gauntlet
Free Anti-Virus Software Fails To Charm Enterprises
Commentary  |  2/24/2012  | 
As free AV gains popularity with consumers, could Symantec and McAfee ever be chased from their top spots in the enterprise?
'Do Not Track' Won't Save You From Yourself
Commentary  |  2/23/2012  | 
Just because you now have a Consumer Privacy Bill of Rights, don't assume you have privacy.
Five Dangerous Compliance Assumptions
Commentary  |  2/23/2012  | 
Many businesses fool themselves about their compliance problems
Can You Delete A Database?
Commentary  |  2/22/2012  | 
Data and databases keep growing, but there's a security tradeoff
Disclosure Clouded By Obscurity
Commentary  |  2/21/2012  | 
Shockingly, the responsible disclosure debate rears its head once again, and amazingly enough some vendors still don't get it. Guess we'll never learn
Google's Privacy Invasion: It's Your Fault
Commentary  |  2/17/2012  | 
If we really wanted privacy, we would turn off JavaScript, block ads, and browse in privacy mode through an anonymous proxy. But we would rather have free services.
What's Behind The Storage Startup Boom?
Commentary  |  2/17/2012  | 
Conditions have been ripe for new storage companies to launch. We're now seeing the fruits of their labor.
What Makes A Top Storage Startup?
Commentary  |  2/17/2012  | 
IT professionals need to keep an eye on the recent boom in innovative, new storage firms. Here's why.
The Financial Industry's Effect On Database Security
Commentary  |  2/15/2012  | 
Security requirements for the financial-services industry differ from other industries
Linux Live Environments: Cool Tools Even For Windows Folks
Commentary  |  2/14/2012  | 
Preconfigured Linux environments provide powerful tools to aid in pen testing, mobile security testing, malware analysis, and forensics
Being A Security Bully Does Not Make You Compliant
Commentary  |  2/14/2012  | 
Compliance is not a tool for dodging work or dismissing business needs
Been Caught Stealin'
Commentary  |  2/14/2012  | 
Emergence of machine to machine (M2M) devices makes life easier for thieves and hackers -- and more dangerous for victims
On Determining Online Identities
Commentary  |  2/10/2012  | 
Forging a stronger tie between the sign-on process and the actual known user who owns that particular account
Between Source Code And Cyanide
Commentary  |  2/9/2012  | 
What the Symantec source-code leak really means
On Determining Online Identities
Commentary  |  2/8/2012  | 
Detecting Online User Identities
RSA Weakness and e-Commerce Authentication
Commentary  |  2/8/2012  | 
RSA key weakness
How Can We Gracefully Update Crypto?
Commentary  |  2/8/2012  | 
Cryptographic methods at any point in time will become weak at some point due to the advances made in computing
Online And Physical User Identities
Commentary  |  2/8/2012  | 
Some data-owning businesses are getting into the Internet authentication market -- and that's good news
I'm Sorry I Called Your Baby Ugly ... But It Is
Commentary  |  2/8/2012  | 
Your product's user interface may not be as appealing as you might think -- and it might just be jeopardizing its adoption
A Response To NoSQL Security Concerns
Commentary  |  2/6/2012  | 
Three key takeaways from a recent webcast about database security in the NoSQL database movement
Passive Network Fingerprinting; p0f Gets Fresh Rewrite
Commentary  |  2/3/2012  | 
Passive network analysis can reveal OS, service, and even vulnerabilities -- just by sniffing the network
Compliance And 'The Little Guys'
Commentary  |  2/3/2012  | 
Small and midsize businesses often let the cost of compliance obscure important benefits
Where's My 'Minority Report' Dashboard?
Commentary  |  2/1/2012  | 
Why haven't user interfaces for security products taken advantage of human movement technologies?


Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: " I think Google Doodle is getting a little out of control"
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] Assessing Cybersecurity Risk
[Strategic Security Report] Assessing Cybersecurity Risk
As cyber attackers become more sophisticated and enterprise defenses become more complex, many enterprises are faced with a complicated question: what is the risk of an IT security breach? This report delivers insight on how today's enterprises evaluate the risks they face. This report also offers a look at security professionals' concerns about a wide variety of threats, including cloud security, mobile security, and the Internet of Things.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.